Small business websites get hacked all the time, not because anyone is targeting them, but because automated tools scan the internet for easy openings. An outdated plugin or a weak password is often enough.
You don't need to be technical to protect yours. A few basic habits cover most of the risk.
- Use strong, unique passwords and two-factor login.
- Keep everything updated.
- Make sure backups exist, and can be restored.
- Know the warning signs.
The basics
None of these require technical knowledge. They're habits, like locking the door when you leave the shop. Together they close most of the easy openings that automated attacks look for, which is what most small business websites actually face.
Strong, unique passwords
Reused passwords are one of the most common ways accounts get taken over.
In practice: A password manager, and a different password for every account.
Two-factor login
A code from your phone makes a stolen password much less useful.
In practice: Two-factor login turned on for your website, domain and email.
Updates
Outdated software, themes and plugins are a common way in.
In practice: Updates applied regularly, by you or your web team.
Backups
If something goes wrong, a recent backup is the fastest way back.
In practice: Automatic backups, stored somewhere else, tested now and then.
If you only do one thing after reading this, turn on two-factor login for your email. Your email is the key to resetting almost every other password, which makes it the most important account to protect.
Check for the padlock
Your website address should start with https, and browsers should show it as secure. Without it, many browsers warn visitors that your website is "not secure", which scares people away from forms.
Most hosting companies provide a security certificate for free, and many add it automatically. If your website doesn't have one, it's usually a quick fix for whoever manages your hosting, and it's worth asking for today.
- 1Open your website and check the address starts with https.
- 2Log in to your website, domain and email, and turn on two-factor login.
- 3Ask whoever runs your website when the last backup was made.
- 4Make a list of everyone who has a login, and remove old ones.
Warning signs
Sometimes the first sign comes from a customer: "I tried to visit your website and my phone said it was dangerous." Take messages like that seriously, even if the website looks normal to you. Problems can appear only for some visitors or devices.
Acting quickly makes a real difference. Most problems are much easier to clean up in the first few days than after weeks of going unnoticed.
Who has access?
Over the years, many people can end up with access to a business's website and accounts: a past designer, an old employee, a nephew who helped once. Every one of those logins is a potential way in.
Removing old access can feel awkward, especially when it's a friend or family member who helped years ago. But it's not personal. It's the same reason you'd change the locks when a key goes missing.
Watch out for phishing
Many website problems start with an email, not a hack. Fake messages claiming your domain is about to expire, your website was "flagged", or your account needs verifying try to get you to click a link and enter your password.
These messages are often convincing, with real logos and urgent deadlines. The safest habit is simple: never log in from a link in an unexpected email. Open your browser, type the address yourself and check there.
- Log in by typing the address yourself, not from an email link
- Check the sender's email address carefully
- Ask your web team when in doubt
- Urgent messages threatening to shut your website down
- Links that lead to login pages with odd addresses
- Requests to pay an unexpected invoice for your domain
If something goes wrong
Don't panic, and don't start deleting things. Contact whoever looks after your website, change your passwords from a safe device, and turn on two-factor login if it wasn't already. A recent backup makes recovery much faster.
Write down what you noticed and when: the strange page, the warning, the date. It helps whoever fixes the problem understand what happened, and it helps you check that everything is back to normal afterward.
Backups: the safety net
Even with every precaution, things can go wrong: a bad update, a mistake, a hack. A recent backup turns a disaster into a minor inconvenience. Without one, you may have to rebuild your website from scratch.
Good backups happen automatically, are kept somewhere other than your website itself, and go back several days or weeks. Most importantly, someone has actually tested restoring one, because a backup that doesn't work isn't a backup.
